GitHub Advisoryadvisory · crates.io
GHSA-3fg9-hcq5-vxrc iana-time-zone vulnerable to use after free in MacOS / iOS implementation
MEDIUM
Official page ↗
- Ecosystem
- crates.io
- Packages
- iana-time-zone
- Severity
- Moderate
- Weaknesses
- CWE-416
- Reviewed
- 2022-08-30
Affected packages
• crates.io iana-time-zone: >= 0.1.43, < 0.1.45 → fixed in 0.1.45
Description
In iana-time-zone v0.1.43 a use-after-free bug in the MacOS / iOS implementation was introduced.
The copied system time zone was released before its name was copied.
If the system time zone was changed between the call of `CFRelease` and `str::to_owned()`,
random memory would be copied.
Related
Weakness · CWE (1)
- CWE-416 Use After Free weakness